from __future__ import absolute_import from __future__ import division from __future__ import print_function from __future__ import unicode_literals # Defines permissions for objects (API related) from rest_framework import permissions from rowers.models import Rower class IsOwnerOrReadOnly(permissions.BasePermission): """ Custom permission to only allow owners of an object to edit it. """ def has_object_permission(self, request, view, obj): # Read permissions are allowed to any request, # so we'll always allow GET, HEAD or OPTIONS requests. if request.method in permissions.SAFE_METHODS: return True # Write permissions are only allowed to the owner of the snippet. return obj.user == request.user class IsOwnerOrNot(permissions.BasePermission): def has_object_permission(self, request, view, obj): r = Rower.objects.get(user=request.user) return (obj.user == r)